What Should Be Done First When Deploying a DLP Solution?
A security administrator is deploying a DLP solution to prevent the exfiltration of sensitive customer data. Which of the following should the administrator do first?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests sequencing in a DLP deployment — classification must define sensitivity before any blocking rule can be meaningful, and the trap is jumping straight to a technical control like blocking email attachments.
When deploying a DLP solution to stop customer data exfiltration, the first step is to apply classifications to the data so the tool knows what to protect. This page confirms why data classification (C) precedes blocking cloud storage, email attachments, or file-share permissions.
Choosing B (block outgoing email attachments) because email is the most obvious exfiltration channel; learners pick the visible enforcement action before the data has been labeled, so the rule cannot distinguish sensitive customer data from routine traffic.
Community Discussion (10 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A DLP engine can only enforce policy against data it can recognize, and recognition depends on labels, patterns tied to labeled data, or classification metadata. Applying classifications to the data (C) establishes which records are sensitive customer data, which is the prerequisite for every later rule, alert, and exception. This ordering matches the risk-management doctrine reflected in the NIST RMF steps referenced by Anyio — categorize first, then select and implement controls. As nyyankee718 puts it, "How would users know what not to send out if data is not classified", which applies equally to the DLP engine itself. Without classification, a DLP deployment produces either massive false positives or silent gaps, and Laura5859 captures the dependency exactly: you classify "so the DLP will be able to identify sensitive data."Why the Other Options Are Wrong
Blocking cloud storage websites (A) is a network/web-filtering action that targets one channel and does nothing for USB, email, or encrypted uploads; it is also a blunt control that breaks legitimate business use. Creating a rule to block outgoing email attachments (B) is enforcement without identification, so the rule either blocks everything (including non-sensitive attachments) or nothing useful; 101e7ca argues classification is optional, but unclassified DLP can only apply blanket rules, which is precisely the outcome most organizations reject. Removing all user permissions from file-server shares (D) is destructive to operations, addresses only internal shares rather than exfiltration, and is not a DLP activity at all. None of these three options establishes what data is sensitive, so none can be the correct first step.Community Comment Notes
The vote is nearly unanimous for C (86 votes), and the reasoning is consistent across commenters. dbrowndiver explains that classification "establishes a foundational understanding of what data is sensitive and needs protection," and several others (Shaman73, ccamarada, G3O, MaxiPrince, Laura5859) simply confirm the classification-first sequence. The single dissenting voice, 101e7ca, favors B and asserts that classification is merely "a nice option" — a plausible-sounding but incorrect position, since DLP without classification cannot tell sensitive customer data from ordinary email. Anyio anchors the concept to the NIST RMF's Prepare/Categorize/Select/Implement sequence, which reinforces that categorization precedes control selection.Official Reference
Exam Strategy
When a question asks for the FIRST step in a deployment or process, eliminate any option that enforces a control before the environment has measured or labeled what it is protecting. Data classification and asset inventory almost always come before policy enforcement in CompTIA sequencing questions.
Frequently Asked Questions
Why is applying data classifications required before creating DLP email rules?
DLP can only block what it can identify. Without classification labels or matching patterns, an email attachment rule blocks legitimate traffic and still misses sensitive data sent over other channels.
Why is blocking cloud storage websites not the first DLP step?
It covers only one exfiltration channel, ignores email, USB, and encrypted uploads, and does not tell the DLP engine what data is sensitive in the first place.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →